<html>
<title>undelete</title>
<body>
<h1>undelete</h1>
Attempts the recovery of deleted files.
<pre>
   <b>undelete [directory] [options]</b>
</pre>
Where [directory] is the location where the file to be undeleted is.
If no directory is given, the current working directory is assumed.<br><br>
There are also more advanced undelete options:
<pre> 
   <b>undelete /action source destination [size]</b>
</pre>
See below for details of the advanced actions and parameters.
<h2>Options</h2>
<pre>
   <b>/ALL</b>
   Undelete ALL files in the given directory without prompting for each file

   <b>/LIST</b>
   Lists files that can be undelete without prompting to undelete; no action
   is taken.
</pre>
<h2>Advanced Actions</h2>
<pre>
   <b>/SYSSAVE</b>
   Saves a copy of the given <b>source</b>, which can be:
      fat1    the FAT (file allocation table), 1st copy
      fat2    the FAT (file allocation table), 2nd copy
      boot    boot sector (part of drive used to start the computer)
      root    root directory

   <b>/FOLLOW</b>
   Looks for a (possibly deleted) file starting at the <b>source</b> cluster
   and saves data to the <b>destination</b> file. The output of <b>DIRSAVE</b>
   helps you to find the right cluster number.

   <b>/DIRSAVE</b>
   Like <b>FOLLOW</b>, but saves a directory to a file. The <b>source</b>
   directory must be given by absolute path starting with \ OR by cluster
   number. Also shows a technical directory listing on the screen.
</pre>
<h2>Other Parameters in the advanced actions</h2>
<pre>
  <b>source</b>
  The exact nature of the source depends upon the action (see above) but
  it is always on the current working drive.

  <b>destination</b>
  The file which will store the recovered data.
  Cannot be on the current drive.

  <b>size</b>
  Optional.
  Overrides the autodetected size (which is sometimes too big).
  The value should be given as the number of:
    - clusters (for action <b>FOLLOW</b>)
    - sectors (for action <b>DIRSAVE</b>)
</pre>
<h2>Using Undelete</h2>

<p><b>1. Finding undeleteable files and directories:</b>

<p>Run undelete in <b>DIRSAVE</b> mode. You will see deleted directory entries
specially marked, and you will see their cluster numbers on the
screen. You can redirect screen output to a file, for example:
<pre>
   undelete DIRSAVE \ x:rescued.dir >logfile
</pre>
Where logfile will contain the screen output.<br>
If you have the FreeDOS utilites installed on your system,
you could use something like one of the following instead:
<pre>
   undelete DIRSAVE \ x:rescued.dir | tee logfile
   undelete DIRSAVE \ x:rescued.dir | tee logfile | <a href="more.htm">more</a>
</pre>
These will display the information on screen as well as store it in the logfile.

<p><b>2. Recovering an undeleteable file</b>

<p>Find the starting cluster of the file using <b>DIRSAVE</b>,
as explained above. Then use <b>FOLLOW</b> on that cluster, for example:
<pre>
   undelete FOLLOW 1234 x:rescued.bin</b>
</pre>
would save the contents of the deleted file starting on cluster 1234
to the file rescued.bin on drive x)

<h2>Advanced Uses</h2>

<p><b>- Recovering from within deleted directories</b><br>
Run <b>DIRSAVE</b> on an existing directory to find the
starting cluster of the deleted directory. Then run <b>DIRSAVE</b> on that
cluster to find deleted files and directories within the deleted directory... and so on
with successive cluster numbers as required.)

<p><b>- Recovering partially overwritten files</b><br>
Use <b>FOLLOW</b> on the existing new files and override the <b>size</b> value
(in clusters, undelete tells you how big a cluster on the current drive is
when you start undelete). So, if you have accidentally overwritten a long file "OLD"
with a short new file "NEW":
<ul>
<li>find the cluster number of "NEW"
<li>give the size of "OLD" when using <b>FOLLOW</b>
<li>The recovered output will begin with the contents of "NEW" but should
contain the not-overwritten end of "OLD" as well, hopefully.
</ul>

<p><b>- Using undelete to "mirror" important drive data</b><br>
If your filesystem gets completely broken, you can try to write back the
important data saved by <b>SYSSAVE</b>. The saved information is to be stored
on a seperate disk. You may also wish to use the <a href="mirror.htm">mirror</a> command,
which is simpler to use but stores the saved information at the end of the disk.
<ul>
<li>Run undelete in <b>SYSSAVE</b> mode for all 4 sources: fat1, fat2, boot, root
<li>Keep the files in a safe place
</ul>

<p><b>- Restoring the "mirror" data</b><br>
This may be necessary in some cases of disk disaster.<br>
<b>WARNING</b>: This is for experts, repair-men and very desperate people only! Doing this incorrectly or unnecessarily could
make things worse!
<ul>
<li>Glue the 4 sources together in the order "boot fat1 fat2 root" to reconstruct
the first part of your partition, starting with the first sector.
<li>you could use debug (w command) to restore this info
<li>You can also merge saved and existing data with a hex editor.
</ul>
<h2>See Also</h2>
<pre>
<a href="mirror.htm">Mirror</a>
<a href="unformat.htm">Unformat</a>
</pre>
<hr>
<address>
<b>Copyright &copy; 2003 <a href="mailto:eric@CoLi.Uni-SB.DE">Eric Auer</a></b>
<br>
This file forms part of The FreeDOS HTML Help Documentation, and is covered
under its terms: see <a href="../index.htm">index.htm</a><br>
</address>
</body>
</html>